How to use an if on Tags ?

[djacquens]

Hi,

I am new to SPLUNK/SPL and I am wondering how can I check if the Tags field contains a tag "foo" within an eval.

Something like:

eval toto = if("tags{}" == "foo", 1,2)'

Thanks,

David

[PickleRick]

Ahhhh... So it's not a tag in terms of "normal" splunk tags. It's just that you have a section of your json event called tags and it has some fields inside.

Does it parse properly? If so, you should probably have fields called tags.*.

So your problem is that you want to find a value among a set of fields.

I'm not sure you can use wildcards in fields specification.

[PickleRick · Accepted solution]

No, you can't simply use wildcards in field names. But you can try one of two approaches.

If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.

Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉

[djacquens]

OK thank you very much.

I used spath:

| spath tags{} output=toto
| eval aa = if(mvfind(toto, "tag_searched")>0, "A", "B")

[PickleRick]

| eval mvfind(tag,"foo")

[djacquens]

Thank you @PickleRick

I tried using mvfind but without any luck.

index = "phantom_container" earliest=-1d 
| dedup id
| eval foo = if(isnull(mvfind(tags, "xyz")), «A» , «B»)

I guess I am not using the correct syntax to access the tags field.
I have the same issue with the field tenant_id.

What am I missing?

Thanks in advance,

David